51 lines
1.7 KiB
Diff
51 lines
1.7 KiB
Diff
|
From 42ea11a81ac853c3e870c70d61ab435d0b09b851 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Johannes Berg <johannes.berg@intel.com>
|
||
|
|
Date: Wed, 28 Sep 2022 21:56:15 +0200
|
||
|
|
Subject: wifi: cfg80211: fix u8 overflow in
|
||
|
|
cfg80211_update_notlisted_nontrans()
|
||
|
|
|
||
|
|
commit aebe9f4639b13a1f4e9a6b42cdd2e38c617b442d upstream.
|
||
|
|
|
||
|
|
In the copy code of the elements, we do the following calculation
|
||
|
|
to reach the end of the MBSSID element:
|
||
|
|
|
||
|
|
/* copy the IEs after MBSSID */
|
||
|
|
cpy_len = mbssid[1] + 2;
|
||
|
|
|
||
|
|
This looks fine, however, cpy_len is a u8, the same as mbssid[1],
|
||
|
|
so the addition of two can overflow. In this case the subsequent
|
||
|
|
memcpy() will overflow the allocated buffer, since it copies 256
|
||
|
|
bytes too much due to the way the allocation and memcpy() sizes
|
||
|
|
are calculated.
|
||
|
|
|
||
|
|
Fix this by using size_t for the cpy_len variable.
|
||
|
|
|
||
|
|
This fixes CVE-2022-41674.
|
||
|
|
|
||
|
|
Reported-by: Soenke Huster <shuster@seemoo.tu-darmstadt.de>
|
||
|
|
Tested-by: Soenke Huster <shuster@seemoo.tu-darmstadt.de>
|
||
|
|
Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
|
||
|
|
Reviewed-by: Kees Cook <keescook@chromium.org>
|
||
|
|
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
||
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
|
---
|
||
|
|
net/wireless/scan.c | 2 +-
|
||
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
|
||
|
|
index 0134e5d5c81a4..f59bfc09ca60f 100644
|
||
|
|
--- a/net/wireless/scan.c
|
||
|
|
+++ b/net/wireless/scan.c
|
||
|
|
@@ -2279,7 +2279,7 @@ cfg80211_update_notlisted_nontrans(struct wiphy *wiphy,
|
||
|
|
size_t new_ie_len;
|
||
|
|
struct cfg80211_bss_ies *new_ies;
|
||
|
|
const struct cfg80211_bss_ies *old;
|
||
|
|
- u8 cpy_len;
|
||
|
|
+ size_t cpy_len;
|
||
|
|
|
||
|
|
lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock);
|
||
|
|
|
||
|
|
--
|
||
|
|
cgit
|
||
|
|
|